Efforts by mainland firms to check the spread of the mass-mailing Klez worm have foundered because unsuspecting staff have an insufficient grasp of English and awareness of the problem to determine whether a file might be infected. Anti-virus experts said viruses that hit the mainland often came in e-mails with English-language subject headers, and some mainlanders did not know how to read between the lines. The problem was testing the ability of mainland firms to deal with the new variant of the Klez worm that first struck last week. The malicious program continuously creates new versions of itself, comes in e-mails or attachments and masquerades as a friendly message with various titles. One variant carried the title 'virus immunity tool', supposedly from six of the world's leading anti-virus software providers such as Symantec. The origin of the Klez worm is unknown, but it slows down those computers it infects to such an extent that many applications become useless. It also leaves behind in infected machines another destructive variant of the ElKern virus. Symantec was receiving more than 3,000 distress calls a day from users infected by the new Klez worm variant in Asia-Pacific, a spokesman said. The spokesman said the call volume for infections in the mainland was relatively light, compared with the 1,500 daily cases reported at the peak of the Sircam virus outbreak last year. Symantec considers the new Klez variant a high-risk infection. It spreads by sending itself as an attachment to e-mail addresses in the Microsoft Windows address book, the ICQ database and local files. The worm randomly chooses a file from the infected machine to send along with the worm to recipients. It spreads through network share drives and is capable of infecting files. The mainland's Cernet Computer Emergency Response Team has listed the new Klez worm infection as its top concern, but noted that it could be treated. Nathan Midler, an Internet consultant with International Data Corp, said mainlanders who seldom used English might not find anything suspicious about the titles of the e-mails they received. There are more than a hundred titles the worm uses. The new Klez worm variant spread by stealth, but Chinese companies had already endured computer virus outbreaks such as Sircam and Code Red in recent years and so must remain vigilant, Mr Midler said. 'If the upper management understands enough about information technology to realise that viruses can wreak awful damage on a company's IT infrastructure, they will support IT staff, give them the budget to buy back-up systems and frequently update anti-virus programs,' he said. He noted that if support was lacking, it usually took one bad infection to change that situation. Part of the problem in the mainland is education. Some office staff take little or no anti-virus precautions. Some install security software improperly, while others lack basic knowledge about how viruses spread. Danny Levinson, chief operating officer at online advertising firm Xianzai.com, said: 'We have a hotel client who was telling us that they don't know why they are always infected with viruses since they bought all their anti-virus software. We put them in touch with a systems company and all it took was a daily regimen of updating their software and informing dumb staff to never ever open stupid attachments.' Computer security experts said people who looked after the computers at most mainland offices kept up with anti-virus advisories and understood the dangers. Either their systems include updated virus scan software, or users do not turn on computers on high-danger days. Daniel Zheng, managing director of Symantec's security response team in Beijing, said: '[Computer security] is getting better. It started [to improve] in 1999, when Chinese users started to have some major problems.'
